Examkin

Question

Difficulty: MediumIncident Response Process and Playbooks

An enterprise security team detects that an automated build server within their CI/CD pipeline has been compromised by an attacker executing unauthorized external network sweeps and downloading secondary payloads. The incident response plan has entered the containment phase. Which of the following actions should the incident response team perform during this phase? (Select TWO.)

  1. Isolate the compromised build server from the internal network by modifying its virtual security group or network interface settings.Answer
  2. Capture a complete volatile memory (RAM) snapshot of the compromised server prior to taking the host offline or rebooting.Answer
  3. C
    Re-image the compromised host using a clean baseline configuration to immediately restore normal build operations.
  4. D
    Conduct a post-incident review with executive leadership to update overall supply chain security policies and playbooks.

Answer

The incident response team should isolate the compromised build server from the network and capture a volatile memory (RAM) snapshot before powering down or re-imaging the host.
During the containment phase, the priority is to stop the incident from spreading while preserving evidence. Modifying network security settings to isolate the host prevents further lateral movement and C2 communications. Capturing volatile memory before rebooting or disconnecting ensures that live process states, active network connections, and unencrypted keys are captured following the order of volatility.

Step-by-Step Solution

1
Identify the primary objectives of the Containment phase in NIST SP 800-61 / ISO 27035 IR frameworks.
The immediate goals are preventing further damage/lateral movement and preserving volatile evidence.
Containment limits the scope of an incident without destroying volatile forensic evidence necessary for root-cause analysis.
2
Evaluate containment options against evidence preservation rules.
Isolating the system via network controls stops network egress/sprouting while keeping memory intact. Capturing RAM preserves volatile state before memory is lost.
Taking volatile captures prior to host shutdown adheres to the order of volatility.
3
Differentiate containment actions from eradication, recovery, and post-incident activities.
System re-imaging belongs to Eradication/Recovery, while updating policies belongs to Post-Incident Activity (Lessons Learned).
Performing remediation or policy update steps out of order disrupts the incident response process and compromises forensic investigations.

Key Concept

Incident Response Lifecycle Phases and Containment Strategies
Estimated Time:1m 30s
Rate this question

Topics

Incident Response Process and Playbooks

More questions from this topic